F2.1f — Add the server container and workspace CI

[Flow-Fly]

Parent: #133. Grandparent: #132 / #72. Depends on: #266, #265, #267, and #268.

Goal

Make the local backend walking skeleton reproducibly buildable and testable in CI before any cloud deployment.

Scope

• Add a multi-stage linux/amd64, non-root server Dockerfile.
• Add workspace-aware shared/server typecheck, tests, and build commands.
• Extend CI to run the shared and server checks.
• Build the server image in CI without publishing it.
• Add a local smoke command that starts the container against local PostgreSQL and MinIO and checks liveness plus readiness.
• Make the process Serverless Container-portable: respect PORT, persist nothing to the filesystem, avoid in-process scheduled jobs, and terminate gracefully.
• Document build context, runtime environment, health behavior, and an immutable commit-SHA image convention.

Out of scope

• No registry push, cloud deploy, production secrets, DNS, auth, or sync.
• No unrelated restructuring of the client workflow.
• No use of latest as a deployment identity.

Acceptance

• CI fails when shared/server typecheck, tests, build, or container build fails.
• The image runs as a non-root user.
• The local container reaches healthy PostgreSQL and MinIO services.
• The container starts only from runtime configuration and does not rely on durable local disk.
• SIGTERM produces an orderly shutdown without leaked connections.
• No secret is baked into the image or committed configuration.

Risk and routing

Risk: medium because this changes shared CI and packaging.
Worker-ready: no; re-brief after the earlier local slices are merged.
Review need: careful CI, portability, and container review.